From: "Darrick J. Wong" <djwong@kernel.org>
To: Brian Foster <bfoster@redhat.com>
Cc: linux-xfs@vger.kernel.org
Subject: Re: [PATCH 2/2] xfs: remove dead stale buf unpin handling code
Date: Tue, 11 May 2021 18:55:19 -0700 [thread overview]
Message-ID: <20210512015519.GX8582@magnolia> (raw)
In-Reply-To: <20210511135257.878743-3-bfoster@redhat.com>
On Tue, May 11, 2021 at 09:52:57AM -0400, Brian Foster wrote:
> This code goes back to a time when transaction commits wrote
> directly to iclogs. The associated log items were pinned, written to
> the log, and then "uncommitted" if some part of the log write had
> failed. This uncommit sequence called an ->iop_unpin_remove()
> handler that was eventually folded into ->iop_unpin() via the remove
> parameter. The log subsystem has since changed significantly in that
> transactions commit to the CIL instead of direct to iclogs, though
> log items must still be aborted in the event of an eventual log I/O
> error. However, the context for a log item abort is now asynchronous
> from transaction commit, which means the committing transaction has
> been freed by this point in time and the transaction uncommit
> sequence of events is no longer relevant.
>
> Further, since stale buffers remain locked at transaction commit
> through unpin, we can be certain that the buffer is not associated
> with any transaction when the unpin callback executes. Remove this
> unused hunk of code and replace it with an assertion that the buffer
> is disassociated from transaction context.
>
> Signed-off-by: Brian Foster <bfoster@redhat.com>
<nod> my brain kinda hurts now, but I have a vague recollection of
wondering how you could get a stale buffer that was also being
removed and not being able to figure out how one might stumble into this
chunk of code. :)
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
--D
> ---
> fs/xfs/xfs_buf_item.c | 20 +-------------------
> 1 file changed, 1 insertion(+), 19 deletions(-)
>
> diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
> index 7ff31788512b..634abf30b5bc 100644
> --- a/fs/xfs/xfs_buf_item.c
> +++ b/fs/xfs/xfs_buf_item.c
> @@ -517,28 +517,10 @@ xfs_buf_item_unpin(
> ASSERT(xfs_buf_islocked(bp));
> ASSERT(bp->b_flags & XBF_STALE);
> ASSERT(bip->__bli_format.blf_flags & XFS_BLF_CANCEL);
> + ASSERT(list_empty(&lip->li_trans) && !bp->b_transp);
>
> trace_xfs_buf_item_unpin_stale(bip);
>
> - if (remove) {
> - /*
> - * If we are in a transaction context, we have to
> - * remove the log item from the transaction as we are
> - * about to release our reference to the buffer. If we
> - * don't, the unlock that occurs later in
> - * xfs_trans_uncommit() will try to reference the
> - * buffer which we no longer have a hold on.
> - */
> - if (!list_empty(&lip->li_trans))
> - xfs_trans_del_item(lip);
> -
> - /*
> - * Since the transaction no longer refers to the buffer,
> - * the buffer should no longer refer to the transaction.
> - */
> - bp->b_transp = NULL;
> - }
> -
> /*
> * If we get called here because of an IO error, we may or may
> * not have the item on the AIL. xfs_trans_ail_delete() will
> --
> 2.26.3
>
next prev parent reply other threads:[~2021-05-12 1:55 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-11 13:52 [PATCH 0/2] xfs: fix buffer use after free on unpin abort Brian Foster
2021-05-11 13:52 ` [PATCH 1/2] xfs: hold buffer across unpin and potential shutdown processing Brian Foster
2021-05-12 1:52 ` Darrick J. Wong
2021-05-12 12:22 ` Christoph Hellwig
2021-05-12 14:29 ` Brian Foster
2021-05-12 14:28 ` Brian Foster
2021-05-11 13:52 ` [PATCH 2/2] xfs: remove dead stale buf unpin handling code Brian Foster
2021-05-12 1:55 ` Darrick J. Wong [this message]
2021-05-12 12:00 ` Christoph Hellwig
2021-05-12 14:29 ` Brian Foster
2021-05-12 14:30 ` [PATCH v1.1 " Brian Foster
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210512015519.GX8582@magnolia \
--to=djwong@kernel.org \
--cc=bfoster@redhat.com \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox